Let us first discuss the scenario of an optimal attack. For Aspis, we used the proposed attack from Section REF  and the corresponding computation of \(c^{(q),Aspis}\)  of Theorem REF . DETOX in [1]} employs a redundant assignment followed by majority voting and offers robustness guarantees which crucially rely on a “random assignment” of tasks to workers and on “random choice” of the Byzantines. The authors of [2]} have demonstrated the importance of a careful task assignment and observed that redundancy is not sufficient to yield Byzantine resilience dividends. They proposed an optimal choice of the \(q\)  Byzantines that maximizes \(\epsilon ^{DETOX}\)  which we used in our experiments. In short, DETOX splits the \(K\)  workers into \(K/r\)  groups. All workers within a group process the same subset of the batch, specifically containing \(br/K\)  samples. This phase is followed by majority voting on a group-by-group basis. The authors of [2]} suggested choosing the Byzantines such that at least \(r^{\prime }\)  workers in each group are adversarial in order to distort the corresponding gradients. In this case, \(c^{(q), DETOX} = \lfloor \frac{q}{r^{\prime }} \rfloor \)  and \(\epsilon ^{DETOX} = \lfloor \frac{q}{r^{\prime }} \rfloor \times r/K\) . We also compare with the distortion fraction incurred by ByzShield [2]} under a worst-case scenario. For this scheme, there is no known optimal attack and its authors performed an exhaustive combinatorial search to find the \(q\)  adversaries that maximize \(\epsilon ^{ByzShield}\)  among all possible options; we follow the same process here to simulate the distortion fraction computation and utilize their scheme based on mutually orthogonal Latin squares. The reader can refer to Tables REF  and REF  for our results. Aspis is able to achieve major reductions in \(\epsilon \) ; for instance, \(\epsilon ^{Aspis}\)  is reduced by up to 97% compared to \(\epsilon ^{Baseline}\) , by up to 98% compared to \(\epsilon ^{DETOX}\)  and by up to 90% compared to \(\epsilon ^{ByzShield}\)  in Table REF .
